Connect a Bugcrowd account

curl --request POST \
  --url https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "identifier": "<string>",
  "programs": [
    "<string>"
  ],
  "secret": "<string>",
  "name": "<string>"
}
'

import requests

url = "https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources"

payload = {
    "identifier": "<string>",
    "programs": ["<string>"],
    "secret": "<string>",
    "name": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    identifier: '<string>',
    programs: ['<string>'],
    secret: '<string>',
    name: '<string>'
  })
};

fetch('https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'identifier' => '<string>',
    'programs' => [
        '<string>'
    ],
    'secret' => '<string>',
    'name' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources"

	payload := strings.NewReader("{\n  \"identifier\": \"<string>\",\n  \"programs\": [\n    \"<string>\"\n  ],\n  \"secret\": \"<string>\",\n  \"name\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"identifier\": \"<string>\",\n  \"programs\": [\n    \"<string>\"\n  ],\n  \"secret\": \"<string>\",\n  \"name\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"identifier\": \"<string>\",\n  \"programs\": [\n    \"<string>\"\n  ],\n  \"secret\": \"<string>\",\n  \"name\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "configuration_version": 123,
  "created_at": "2023-11-07T05:31:56Z",
  "credential_configured": true,
  "display_name": "<string>",
  "documentation": {
    "answers": [
      "<string>"
    ],
    "format": "<string>",
    "inline_configured": true,
    "resolved_url": "<string>",
    "url": "<string>",
    "urls": [
      "<string>"
    ]
  },
  "enabled": true,
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "kind": "hackerone",
  "name": "<string>",
  "schedule": "1h",
  "setup_mode": "documentation",
  "status": "draft",
  "team_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "tested_configuration_version": 123,
  "updated_at": "2023-11-07T05:31:56Z",
  "auto_triage": {
    "enabled": true,
    "interval_minutes": 123,
    "last_error_code": "<string>",
    "last_run_at": "2023-11-07T05:31:56Z",
    "next_run_at": "2023-11-07T05:31:56Z"
  },
  "last_error_code": "<string>",
  "last_synced_at": "2023-11-07T05:31:56Z",
  "mapping": {
    "external_key": "<string>",
    "description": "<string>",
    "reporter": "<string>",
    "severity": "<string>",
    "severity_values": {},
    "status": "<string>",
    "title": "<string>",
    "updated_at": "<string>",
    "url": "<string>"
  },
  "next_sync_at": "2023-11-07T05:31:56Z",
  "pagination": {
    "type": "none",
    "cursor_param": "<string>",
    "cursor_path": "<string>",
    "items_path": "<string>",
    "next_url_path": "<string>",
    "page_param": "<string>",
    "page_size": 500,
    "size_param": "<string>",
    "start": 1
  },
  "preset": "bugcrowd",
  "request_template": {
    "method": "GET",
    "url": "<string>",
    "auth": {
      "type": "none",
      "header_name": "<string>",
      "query_name": "<string>",
      "scopes": "<string>",
      "token_url": "<string>"
    },
    "body": "<unknown>",
    "headers": {},
    "query": {}
  },
  "scanner": {
    "provider": "<string>",
    "provider_label": "<string>",
    "settings": {}
  },
  "setup_report": {
    "at": "2023-11-07T05:31:56Z",
    "notes": "<string>",
    "outcome": "<string>",
    "read": [
      {
        "kind": "<string>",
        "url": "<string>",
        "resolved_url": "<string>"
      }
    ],
    "tried": [
      {
        "mapped": 123,
        "method": "<string>",
        "records": 123,
        "status": 123,
        "url": "<string>"
      }
    ],
    "question": {
      "needs": "<string>",
      "text": "<string>",
      "options": [
        "<string>"
      ]
    }
  },
  "steps": [
    {
      "method": "GET",
      "url": "<string>",
      "auth": {
        "type": "none",
        "header_name": "<string>",
        "query_name": "<string>",
        "scopes": "<string>",
        "token_url": "<string>"
      },
      "body": "<unknown>",
      "capture": {},
      "headers": {},
      "query": {}
    }
  ]
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

Triage

Connect a Bugcrowd account

Connect a Bugcrowd account with its API credential and the programs to synchronize. Team admins only; a user without a team gets one after validation. Bugcrowd checks the credential and Neo reads the first page of submissions before anything is stored. The new source is a custom API source with preset bugcrowd: Neo writes and keeps its request template, pagination and mapping. It starts in setting_up and its first synchronization is queued. A team may connect several Bugcrowd accounts, but each program is synchronized by one source only.

POST

api

triage

bugcrowd

sources

Connect a Bugcrowd account

curl --request POST \
  --url https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "identifier": "<string>",
  "programs": [
    "<string>"
  ],
  "secret": "<string>",
  "name": "<string>"
}
'

import requests

url = "https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources"

payload = {
    "identifier": "<string>",
    "programs": ["<string>"],
    "secret": "<string>",
    "name": "<string>"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    identifier: '<string>',
    programs: ['<string>'],
    secret: '<string>',
    name: '<string>'
  })
};

fetch('https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'identifier' => '<string>',
    'programs' => [
        '<string>'
    ],
    'secret' => '<string>',
    'name' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources"

	payload := strings.NewReader("{\n  \"identifier\": \"<string>\",\n  \"programs\": [\n    \"<string>\"\n  ],\n  \"secret\": \"<string>\",\n  \"name\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"identifier\": \"<string>\",\n  \"programs\": [\n    \"<string>\"\n  ],\n  \"secret\": \"<string>\",\n  \"name\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://neo.api.projectdiscovery.io/api/v1/triage/bugcrowd/sources")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"identifier\": \"<string>\",\n  \"programs\": [\n    \"<string>\"\n  ],\n  \"secret\": \"<string>\",\n  \"name\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "configuration_version": 123,
  "created_at": "2023-11-07T05:31:56Z",
  "credential_configured": true,
  "display_name": "<string>",
  "documentation": {
    "answers": [
      "<string>"
    ],
    "format": "<string>",
    "inline_configured": true,
    "resolved_url": "<string>",
    "url": "<string>",
    "urls": [
      "<string>"
    ]
  },
  "enabled": true,
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "kind": "hackerone",
  "name": "<string>",
  "schedule": "1h",
  "setup_mode": "documentation",
  "status": "draft",
  "team_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "tested_configuration_version": 123,
  "updated_at": "2023-11-07T05:31:56Z",
  "auto_triage": {
    "enabled": true,
    "interval_minutes": 123,
    "last_error_code": "<string>",
    "last_run_at": "2023-11-07T05:31:56Z",
    "next_run_at": "2023-11-07T05:31:56Z"
  },
  "last_error_code": "<string>",
  "last_synced_at": "2023-11-07T05:31:56Z",
  "mapping": {
    "external_key": "<string>",
    "description": "<string>",
    "reporter": "<string>",
    "severity": "<string>",
    "severity_values": {},
    "status": "<string>",
    "title": "<string>",
    "updated_at": "<string>",
    "url": "<string>"
  },
  "next_sync_at": "2023-11-07T05:31:56Z",
  "pagination": {
    "type": "none",
    "cursor_param": "<string>",
    "cursor_path": "<string>",
    "items_path": "<string>",
    "next_url_path": "<string>",
    "page_param": "<string>",
    "page_size": 500,
    "size_param": "<string>",
    "start": 1
  },
  "preset": "bugcrowd",
  "request_template": {
    "method": "GET",
    "url": "<string>",
    "auth": {
      "type": "none",
      "header_name": "<string>",
      "query_name": "<string>",
      "scopes": "<string>",
      "token_url": "<string>"
    },
    "body": "<unknown>",
    "headers": {},
    "query": {}
  },
  "scanner": {
    "provider": "<string>",
    "provider_label": "<string>",
    "settings": {}
  },
  "setup_report": {
    "at": "2023-11-07T05:31:56Z",
    "notes": "<string>",
    "outcome": "<string>",
    "read": [
      {
        "kind": "<string>",
        "url": "<string>",
        "resolved_url": "<string>"
      }
    ],
    "tried": [
      {
        "mapped": 123,
        "method": "<string>",
        "records": 123,
        "status": 123,
        "url": "<string>"
      }
    ],
    "question": {
      "needs": "<string>",
      "text": "<string>",
      "options": [
        "<string>"
      ]
    }
  },
  "steps": [
    {
      "method": "GET",
      "url": "<string>",
      "auth": {
        "type": "none",
        "header_name": "<string>",
        "query_name": "<string>",
        "scopes": "<string>",
        "token_url": "<string>"
      },
      "body": "<unknown>",
      "capture": {},
      "headers": {},
      "query": {}
    }
  ]
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

{
  "error": "Bad request",
  "code": "user_spending_cap_reached",
  "error_id": "<string>",
  "kind": "forbidden request",
  "message": "<string>",
  "param": "<string>",
  "turnstile_site_key": "<string>"
}

Authorizations

Authorization

string

header

required

JWT authentication token

Body

application/json

identifier

string

required

Required string length: 1 - 256

programs

string[]

required

Codes of the programs to synchronize (from POST /api/v1/triage/bugcrowd/programs).

Required array length: 1 - 10 elements

Required string length: 1 - 120

secret

string

required

Required string length: 1 - 1024

name

string

Source name; defaults to "Bugcrowd" and the organization name.

Maximum string length: 80

schedule

enum<string>

Interval between scheduled synchronizations.

Available options:

1h,

6h,

12h,

24h

Response

Source created and its first synchronization queued

A Triage source of your team. Credentials are never returned: credential_configured shows whether one is stored.

configuration_version

integer

required

Incremented by every change of documentation, request template, pagination or mapping.

created_at

string<date-time>

required

credential_configured

boolean

required

display_name

string

required

The name to show: the display name set in the source settings, or the source name when none is set. Inbox listings keep writing the provider name to name; they never change the display name.

documentation

object

required

Documentation reference of a source. Pasted documents are not returned.

Show child attributes

enabled

boolean

required

True when scheduled synchronization is on.

string<uuid>

required

kind

enum<string>

required

hackerone, github and gmail are built-in connections; custom_api is a source you configure.

Available options:

hackerone,

github,

gmail,

custom_api,

scanner

name

string

required

schedule

enum<string>

required

Interval between scheduled synchronizations.

Available options:

1h,

6h,

12h,

24h

setup_mode

enum<string>

required

documentation reads an OpenAPI 3 or Swagger 2 document to propose the configuration; manual takes the configuration as entered.

Available options:

documentation,

manual

status

enum<string>

required

Server-controlled lifecycle state of a source. A failed scheduled or manual synchronization sets failed and backs the next one off (the schedule interval times 2^min(failures, 4), at most 24 hours later). After 10 failed synchronizations in a row the source is paused: disabled, enabled false, last_error_code kept. A successful synchronization or re-enabling the source resets the count.

Available options:

draft,

analyzing,

configuration_required,

testing,

setting_up,

ready,

syncing,

failed,

disabled,

removed

team_id

string<uuid>

required

tested_configuration_version

integer

required

Configuration version that last passed a test (0 when none). Synchronization needs it to equal configuration_version.

updated_at

string<date-time>

required

auto_triage

object

The auto triage rule of a source as the source list shows it.

Show child attributes

last_error_code

string

Stable code of the last failure, such as target_not_public or upstream_status. On a ready source it is a warning from the last synchronization, such as record_limit or page_limit when the listing was longer than one synchronization reads.

last_synced_at

string<date-time>

mapping

object

Dot paths from each provider record to the normalized finding fields. external_key identifies a record inside the source.

Show child attributes

next_sync_at

string<date-time>

Custom API sources: the next scheduled synchronization. HackerOne and Security Inbox sources: the next refresh of the built-in refresh job, which reads the first page of the connection. GitHub sources are refreshed by listing only.

pagination

object

How a synchronization walks the listing.

Show child attributes

preset

enum<string> | null

Set on a custom API source whose configuration Neo writes and keeps (a connected Bugcrowd account). Its documentation, request template, pagination, mapping and steps cannot be changed, and it is not analyzed.

Available options:

bugcrowd

request_template

object

The request a synchronization sends. Header and query values are stored and returned as typed, so never put a credential in them.

Show child attributes

scanner

object

Present only when kind is scanner.

Show child attributes

setup_report

object

Custom API sources with the source-setup agent on: the outcome of the last analysis or test run, in plain terms. Absent until one finished.

Show child attributes

steps

object[]

Requests sent in order before the findings request (a login, a token exchange), at setup and at every synchronization. Values a step captures, and the credential fields, are used as {{$name}} placeholders in header values, query values, the URL path and query, and body strings of later steps and of request_template.

Maximum array length: 3

Show child attributes